Improved Space Bounds for Subset Sum

More than 40 years ago, Schroeppel and Shamir presented an algorithm that solves the Subset Sum problem for $n$ integers in time $O^*(2^{0.5n})$ and space $O^*(2^{0.25n})$. The time upper bound remains unbeaten, but the space upper bound has been improved to $O^*(2^{0.249999n})$ in a recent breakthrough paper by Nederlof and W\k{e}grzycki (STOC 2021). Their algorithm is a clever combination of a number of previously known techniques with a new reduction and a new algorithm for the Orthogonal Vectors problem. In this paper, we give two new algorithms for Subset Sum. We start by presenting an Arthur--Merlin algorithm: upon receiving the verifier's randomness, the prover sends an $n/4$-bit long proof to the verifier who checks it in (deterministic) time and space $O^*(2^{n/4})$. The simplicity of this algorithm has a number of interesting consequences: it can be parallelized easily; also, by enumerating all possible proofs, one recovers upper bounds on time and space for Subset Sum proved by Schroeppel and Shamir in 1979. As it is the case with the previously known algorithms for Subset Sum, our algorithm follows from an algorithm for $4$-SUM: we prove that, using verifier's coin tosses, the prover can prepare a $\log_2 n$-bit long proof verifiable in time $\tilde{O}(n)$. Another interesting consequence of this result is the following fine-grained lower bound: assuming that $4$-SUM cannot be solved in time $O(n^{2-\varepsilon})$ for all $\varepsilon>0$, Circuit SAT cannot be solved in time $O(g2^{(1-\varepsilon)n})$, for all $\varepsilon>0$. Then, we improve the space bound by Nederlof and W\k{e}grzycki to $O^*(2^{0.246n})$ and also simplify their algorithm and its analysis. We achieve this space bound by further filtering sets of subsets using a random prime number. This allows us to reduce an instance of Subset Sum to a larger number of instances of smaller size.